Cracking the code: understanding merchant category codes (MCCs)

Merchant Category Codes (MCCs) are a vital component of the payment processing landscape, yet many businesses and even some industry professionals may not fully grasp their significance. In this post, we'll delve into what MCCs are, why they matter, and how they impact the payment ecosystem.

What are MCCs?

MCCs are four-digit codes assigned to businesses by payment card networks such as Visa, Mastercard, and American Express. Some of these networks may use different terminology (for example, card acceptor business code), but the abbreviation MCC is used throughout the industry. These codes categorise merchants based on the products or services they offer and the industries they operate in. For example, a restaurant might be assigned the MCC 5812, while a retail clothing store could have the MCC 5651.

Why are MCCs important?

MCCs play a crucial role in payment processing for several reasons:

1. Transaction Classification: MCCs help card networks and issuing banks classify transactions accurately. This classification is essential for tracking spending patterns, identifying fraudulent activity, and ensuring compliance with regulatory requirements.
2. Interchange Fees: MCCs influence the interchange fees that merchants pay for each card transaction. Card networks use MCCs to determine the appropriate interchange rate based on factors such as the merchant's industry and transaction type. Understanding and optimising MCCs can help merchants manage their interchange costs effectively.
3. Risk Management: MCCs also play a role in assessing risk in the payment ecosystem. Certain industries, such as gambling or adult entertainment, may be considered higher risk, leading to additional scrutiny from acquiring banks and payment processors.

Impacts on different stakeholders

• Merchants: For merchants, understanding MCCs is essential for managing costs, complying with regulations, and optimising payment processing strategies. By selecting the most appropriate MCCs for their businesses and transactions, merchants can potentially reduce interchange fees and improve their overall profitability.
• Payment Processors: Payment processors use MCCs to route transactions, apply appropriate interchange rates, and mitigate risk. They must accurately categorise merchants' transactions to ensure compliance with card network rules and regulations.
• Issuing Banks: Issuing banks rely on MCCs to monitor cardholder spending, detect suspicious activity, and personalise cardholder experiences. MCC data helps banks identify trends, target marketing efforts, and enhance fraud detection capabilities.

The fuzziness of MCCs

Determining the appropriate Merchant Category Code for certain businesses can present challenges due to the nuanced nature of their operations. Some companies offering subscription-based services or unique product offerings may fall into multiple MCC categories, making it difficult to place them definitively. Where this happens, it is best practice to assign the MCC for the aspect of the business that causes or is considered the most risky.

Different card schemes often have varying definitions for their high-risk Merchant Category Codes, contributing to inconsistencies in categorisation across payment networks. For example, a business classified as high-risk by one card scheme may not necessarily receive the same designation from another. These differences stem from distinct risk assessment criteria and regulatory considerations employed by each card scheme.

MCCs and card schemes

When registering with card schemes, accurately assigning Merchant Category Codes is crucial since the card schemes categorise merchants as high-risk or high-brand risk according to their MCC. This entails registering them with the card networks and implementing more stringent merchant due diligence guidelines.

Since its launch in 2005, Mastercard's Business Risk Assessment and Mitigation (BRAM) program has adapted to changing trends. In the spring of 2023, updates were introduced to tackle concerns like illegal activities and brand damage. These cover various areas such as Russia’s war in Ukraine-related scams and non-face-to-face gambling. BRAM requires monthly reports from acquirers or Merchant Monitoring Service Providers (MMSP) like Web Shield to monitor merchant activities closely. These measures aim to protect brand reputation and ensure a secure business environment.

Similarly to Mastercard's BRAM, Visa's Integrity Risk Program (VIRP) was launched in 2023 as a replacement for the Global Brand Protection Program (GBPP). It formalises the obligations of both Visa and acquirers concerning high-brand risk and illegal transactions. Under VIRP, merchants are categorised into three tiers based on their level of risk, with tier one being the highest risk. Acquirers are required to register merchants within 60 days of notification and must demonstrate adequate controls to mitigate risks, including collecting and retaining specific transaction data. Additionally, VIRP introduced updated requirements for supporting high-integrity risk merchants, including registration fees and specific MCC categories for each tier.

MCCs in underwriting and beyond

MCCs play a crucial role in payment processing in general, affecting merchants, payment processors, and issuing banks alike. Understanding MCCs and their implications empowers businesses to make informed decisions, optimising payment operations, managing costs, and mitigating risks effectively.

Looking at the role of the merchant underwriter, compliance specialist, and risk manager, allocating the right MCC to the right merchant becomes even more important. Certain merchants inherently deal with specific content, such as pharmaceutical merchants offering medications. When the correct MCC is assigned, underwriters should not be concerned about encountering listings of prescription drugs on such sites and they should not count them as violations - whereas this should alarm you on any other generic eCommerce websites. This goes double for automated systems: even the most sophisticated machine learning algorithms will deliver subpar results or false positives if the MCC is assigned incorrectly.

While crucial, assigning MCCs can be a cumbersome and often manual process that is prone to human error. It also requires a deep understanding of MCC codes and their risk levels. Enter MCC Detect 2.0, the latest iteration of Web Shield's MCC allocation software. It uses cutting-edge AI and machine learning to find the most probable MCC for your merchant. Having been configured by experienced underwriters, it takes the latest best practices into account and allows you to automate your onboarding process even further.

Reach out to us and consult with an expert to explore its functionality and discover how it can enhance your business. Contact us now to streamline your merchant due diligence process: Contact us

‍